tree 49c387f4271a447d3bb4946d953faf5018eae5bb
parent 1c4a7881c492790eaad9aec1bcc2c1370f41740f
author David Malcolm <dmalcolm@redhat.com> 1668818305 -0500
committer David Malcolm <dmalcolm@redhat.com> 1668818305 -0500

analyzer: fix feasibility false +ve on jumps through function ptrs [PR107582]

PR analyzer/107582 reports a false +ve from
-Wanalyzer-use-of-uninitialized-value where
the analyzer's feasibility checker erroneously decides
that point (B) in the code below is reachable, with "x" being
uninitialized there:

    pthread_cleanup_push(func, NULL);

    while (ret != ETIMEDOUT)
	ret = rand() % 1000;

    /* (A): after the while loop  */

    if (ret != ETIMEDOUT)
      x = &z;

    pthread_cleanup_pop(1);

    if (ret == ETIMEDOUT)
      return 0;

    /* (B): after not bailing out  */

due to these contradictionary conditions somehow both holding:
  * (ret == ETIMEDOUT), at (A) (skipping the initialization of x), and
  * (ret != ETIMEDOUT), at (B)

The root cause is that after the while loop, state merger puts ret in
the exploded graph in an UNKNOWN state, and saves the diagnostic at (B).

Later, as we explore the feasibilty of reaching the enode for (B),
dynamic_call_info_t::update_model is called to push/pop the
frames for handling the call to "func" in pthread_cleanup_pop.
The "ret" at these nodes in the feasible_graph has a conjured_svalue for
"ret", and a constraint on it being either == *or* != ETIMEDOUT.

However dynamic_call_info_t::update_model blithely clobbers the
model with a copy from the exploded_graph, in which "ret" is UNKNOWN.

This patch fixes dynamic_call_info_t::update_model so that it
simulates pushing/popping a frame on the model we're working with,
preserving knowledge of the constraint on "ret", and enabling the
analyzer to "know" that the bail-out must happen.

Doing so fixes the false positive.

gcc/analyzer/ChangeLog:
	PR analyzer/107582
	* engine.cc (dynamic_call_info_t::update_model): Update the model
	by pushing or pop a frame, rather than by clobbering it with the
	model from the exploded_node's state.

gcc/testsuite/ChangeLog:
	PR analyzer/107582
	* gcc.dg/analyzer/feasibility-4.c: New test.
	* gcc.dg/analyzer/feasibility-pr107582-1.c: New test.
	* gcc.dg/analyzer/feasibility-pr107582-2.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>